Threats affecting pkg:pypi/mistral-vibe

Mistral Vibe versions before 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by defining git filter drivers in an untrusted repository's .git/config file. When the application is started with the --worktree option, git worktree add applies .gitattributes and runs filter commands before verifying the trusted folder, leading to execution of attacker-controlled commands with user privileges. The vulnerability is fixed in version 3.0.3.